Skip to content

[fix](fe) Add user existence check in DropRowPolicyCommand #63631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
heguanhui wants to merge 1 commit into
base: master
Choose a base branch
from
+37 −4
Open

[fix](fe) Add user existence check in DropRowPolicyCommand #63631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions ...ore/src/main/java/org/apache/doris/nereids/trees/plans/commands/DropRowPolicyCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,16 +70,19 @@ public void doRun(ConnectContext ctx, StmtExecutor executor) throws Exception {
* validate
*/
public void validate(ConnectContext ctx) throws AnalysisException {
tableNameInfo.analyze(ctx.getNameSpaceContext());
if (user != null) {
user.analyze();
}
// check auth
if (!Env.getCurrentEnv().getAccessManager()
.checkGlobalPriv(ConnectContext.get(), PrivPredicate.GRANT)) {
ErrorReport.reportAnalysisException(ErrorCode.ERR_SPECIFIC_ACCESS_DENIED_ERROR,
PrivPredicate.GRANT.getPrivs().toString());
}
tableNameInfo.analyze(ctx.getNameSpaceContext());
if (user != null) {
Copy link
Copy Markdown
Contributor

@morrySnow morrySnow May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in doris, we maybe use external Authentication Service or use a temporary user. So users do not necessarily always exist in Doris.

Copy link
Copy Markdown
Contributor Author

@heguanhui heguanhui May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just to maintain consistency with the user existence verification when creating the policy

user.analyze();
if (!Env.getCurrentEnv().getAuth().doesUserExist(user)) {
throw new AnalysisException("user not exist: " + user);
}
}
}

public boolean isIfExists() {
Expand Down
23 changes: 23 additions & 0 deletions ...src/test/java/org/apache/doris/nereids/trees/plans/commands/DropRowPolicyCommandTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,10 @@
import org.apache.doris.analysis.UserIdentity;
import org.apache.doris.catalog.Env;
import org.apache.doris.catalog.info.TableNameInfo;
import org.apache.doris.common.AnalysisException;
import org.apache.doris.common.jmockit.Deencapsulation;
import org.apache.doris.mysql.privilege.AccessControllerManager;
import org.apache.doris.mysql.privilege.Auth;
import org.apache.doris.mysql.privilege.PrivPredicate;
import org.apache.doris.qe.ConnectContext;
import org.apache.doris.utframe.TestWithFeService;
Expand All @@ -36,13 +38,15 @@ public class DropRowPolicyCommandTest extends TestWithFeService {
private ConnectContext connectContext;
private Env env;
private AccessControllerManager accessControllerManager;
private Auth auth;
private UserIdentity user;
private TableNameInfo tableNameInfo;

private void runBefore() throws IOException {
connectContext = createDefaultCtx();
env = Env.getCurrentEnv();
accessControllerManager = env.getAccessManager();
auth = env.getAuth();
user = new UserIdentity("jack", "127.0.0.1", true);
tableNameInfo = new TableNameInfo("test_db", "test_tbl");
}
Expand All @@ -54,7 +58,26 @@ public void testValidateNormal() throws Exception {
Mockito.doReturn(true).when(spyAcm).checkGlobalPriv(
Mockito.nullable(ConnectContext.class), Mockito.eq(PrivPredicate.GRANT));
Deencapsulation.setField(env, "accessManager", spyAcm);
Auth spyAuth = Mockito.spy(auth);
Mockito.doReturn(true).when(spyAuth).doesUserExist(Mockito.any(UserIdentity.class));
Deencapsulation.setField(env, "auth", spyAuth);
DropRowPolicyCommand command = new DropRowPolicyCommand(false, "test_policy", tableNameInfo, user, "role1");
Assertions.assertDoesNotThrow(() -> command.validate(connectContext));
}

@Test
public void testValidateUserNotExist() throws Exception {
runBefore();
AccessControllerManager spyAcm = Mockito.spy(accessControllerManager);
Mockito.doReturn(true).when(spyAcm).checkGlobalPriv(
Mockito.nullable(ConnectContext.class), Mockito.eq(PrivPredicate.GRANT));
Deencapsulation.setField(env, "accessManager", spyAcm);
Auth spyAuth = Mockito.spy(auth);
Mockito.doReturn(false).when(spyAuth).doesUserExist(Mockito.any(UserIdentity.class));
Deencapsulation.setField(env, "auth", spyAuth);
DropRowPolicyCommand command = new DropRowPolicyCommand(false, "test_policy", tableNameInfo, user, null);
AnalysisException ex = Assertions.assertThrows(AnalysisException.class,
() -> command.validate(connectContext));
Assertions.assertTrue(ex.getMessage().contains("user not exist"));
}
}
7 changes: 7 additions & 0 deletions regression-test/suites/query_p0/test_row_policy.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,4 +90,11 @@ suite("test_row_policy") {
"""
exception "system user"
}

test {
sql """
DROP ROW POLICY policy_01 ON ${tableName} FOR non_exist_user
"""
exception "non_exist_user"
}
}
Loading